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This listing of claims will replace all prior versions and listings of claims in the application. 
Listing of Claims: 



calculating traffic statistics associated with packet flows through a network; 
storing the traffic statistics within a flow table: 

maintaining a heap that provides a heap-ordered representation of at least a portion of t he 
traffic statistics of the p acket flows within the flow table , wherein the heap is a tree having a root 
node and a plurality of other nodes arranged as parent nodes and child nodes> each of the nodes 
storing traffic statistics for a different one of the packet flows, and wherein the tree is heap- 
ordered in that a value for the traffic statistics stored in any child node of the tree is less than or 
equal to a value for the traffic statistics stored within that chi ld node's parent node within the 
tree : 

processing the heap to select one or more of the packet flows; and 
outputting the traffic statistics associated with the selected packet flows. 

Claim 2 (Currently Amended) The method of claim 1 , further comprioingr^ grin, 

processing the heap to select one or more of the packet flows comprises: 
receiving a query from a client- 
processing the heap in response to the query to select one or more of the nodes of the tree 

while continuing to update the traffic flow statistics in the flow table in response to network 

traffic : and 

outputting the traffic statistics associated with the selected nodes of the tree s aekets to the 

client. 



Claim 1 (Currently Amended) 



A method comprising: 
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Claim 3 (Currently Amended) The method of claim 1, wherein processing the heap 
comprises: 

cloning the heap to produce a heap clone in the form of a tree having a root node and a 
plurality of other nodes arranged as parent nodes and child nodes , the nodes of the heap clone, 
storing copies of the traffic statistics stored by the nodes of the heap ; and 

extracting one or more nodes heap entries from the heap clone to select the packet flows. 

Claim 4 (Original) The method of claim I, wherein calculating traffic statistics and 
maintaining a heap are performed concurrently with processing the heap and outputting the 
traffic statistics. 

Claim 5 (Currently Amended) The method of claim 1, wherei n calculating traffic statistics 
compris e s maintaining a flow table that otoreo traffic flow gtatiotioa for - a set of pack e t fl e w s. 
maintaining a heap comprises maintaining the heap in real-time to reflect changes to the traffic 
statistics within flow tabl e. 

Claim 6 (Original) . The method of claim l r wherein maintaining a heap comprises maintaining 
a table representation of the heap. 

Claim 7 (Original) The method of claim 6 ? wherein maintaining the heap comprises storing 
packet flow identifiers as elements of the table and in a heap-ordered fashion. 

Claim 8 (Original) The method of claim 1, further comprising identifying the packet flows by 
at least one of a source network address, a destination network address, a protocol, a source port 
number, and a destination port number. 
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Claim 9 (Original) The method of claim 1, wherein calculating traffic statistics comprises: 
receiving a packet from a network via an interface card of a network device; and 
extracting a key from the packet; 

associating the packet with one of the packet flows based on the key; and 

updating the flow statistics for the associated packet flow based on contents of the packet. 

Claim 1 0 (Original) The method of claim 9, wherein maintaining a heap comprises performing 
a heapify operation on the heap after receiving the packet and updating the flow statistics. 

Claim 1 1 (Original) The method of claim 1 , wherein calculating traffic statistics further 
comprises communicating the packets to an accounting service card of a network device, wherein 
the accounting service card calculates the traffic statistics. 

Claim 1 2 (Original) The method of claim 1 , further comprising: 

receiving a query from a network client, wherein the query requests Murdered packet 

flows; 

cloning the heap to produce a heap clone in response to the query 
performing M-l heapify operations to extract the M ordered packet flow identifiers from 
the heap; and 

outputting the traffic statistics associated with the M packet flow identifiers. 
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Claim 13 (Currently Amended) A method comprising: 

maintaining a heap that provides a heap-ordered representation of packet flows within a 
network based on at least one criteria associated with the packet flows, the heap-ordered 
representation of packet flows comprising is a tree having:a root no_d_e_and_a plurality of other 
nodes arranged as parent nodes and child nodes, each of the nodes storing traffic statistics for a 
different one of the packet flows, and wherein a value for the traffic statistics stored in any child 
node is less than or equal to a value for the traffic statistics stor_ed_forJ_ts_parent node within the 
tree ; and 

processing the heap to output traffic statistics associated with an ordered subset of the 
packet flows. 

Claim 14 (Original) The method of claim 13, wherein the criteria comprises one of a byte 
count and a packet count associated with each of the packet flows. 

Claim 1 5 (Original) The method of claim 1 3, wherein processing the heap comprises: 
receiving a query from a nerwork client; 
cloning the heap to produce a heap clone; 

extracting one or more heap entries from the heap clone to extract identifiers for the 
ordered subset of the packet flows; and 

outputting the traffic statistics associated with the extracted identifiers. 

Claim 1 6 (Original) The method of claim 1 3, wherein maintaining a heap is performed 
concurrently with processing the heap. 
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Claim 17 (Withdrawn) A method comprising: 

maintaining a data structure that stores N packet flow identifiers for packet flows within a 
network; 

receiving a query from a network client, wherein the query requests traffic flow statistics 
for M packet flows selected from the N packet flows based on an ordered relationship to a 
criteria; 

applying an algorithm to process the data structure to identify the M packet flows in a 
computational time that can be represented as less than or equal to 0(Mlog(N)); and 
outputting the traffic statistics associated with the M packet flows. 

Claim 1 8 (Withdrawn) The method of claim 17, wherein the criteria comprises one of a 
byte count and a packet count associated with each of the packet flows. 

Claim 1 9 (Withdrawn) The method of claim 17, wherein the data structure comprises a 
heap that provides a heap-ordered representation of the packet flows. 

Claim 20 (Withdrawn) The method of claim 1 9, wherein applying an algorithm comprises: 
cloning the heap to produce a heap clone; 

extracting one or more heap entries from the heap clone to extract packet flow identifiers 
for the M packet flows; and 

outputting the traffic statistics associated with the extracted identifiers. 

Claim 21 (Original) A computer-readable medium comprising instructions for causing a 
programmable processor to: 

calculate traffic statistics associated with packet flows through a network; 

maintain a heap that provides a heap-ordered representation of the packet flows; 

process the heap to select one or more of the packet flows; and 

output the traffic statistics associated with the selected packet flows. 
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Claim 22 (Original) The computer-readable medium of claim 21 , further comprising- 
instructions to cause the processor to: 

receive a query from a network client; 

process the heap in response to the query; and 

output the traffic statistics associated with the selected packets to the network client. 

Claim 23 (Original) The computer-readable medium of claim 21 , wherein the instructions 
cause the processor to: ' 
clone the heap to produce a heap clone; and 

extract one or more heap entries from the heap clone to select the packet flows. 

Claim 24 (Original) The computer-readable medium of claim 2U wherein the instructions 
cause the processor to perform calculating traffic statistics and maintaining a heap concurrently 
with processing the heap and outputting the traffic statistics. 

Claim 25 (Original) The computer-readable medium of claim 21, wherein the instructions 
cause the processor to maintain a flow table that stores traffic flow statistics for a set of packet 
flows. 

Claim 26 (Original) The computer-readable medium of claim 21 , wherein the instructions 
cause the processor to maintain a table representation of the heap. 

Claim 27 (Original) The computer-readable medium of claim 21 , wherein the instructions 
cause the processor to store packet flow identifiers with the heap in a heap-ordered fashion. 
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Claim 28 (Currently Amended) Network elements comprising: 
an interface to receive packets flows from a network; and 
a control unit coupled to the interface, 

wherein the control unit computes flow statistics for the packets, and maintains identifiers 
for the packet flows in a heap-ordered representation based on at least one of the statistics, 
wherein the heap-ordered representation is a tree having a root node and a plurality of other 
nodes arranged as parent nodes and child nodes, each of the nodes storing traffic statistics for a 
different one of the packet flows, and wherein the tree is heap-ordered in that a value for the 
traffic statistics stored in any child node of the tree is less than or equal to a value for the traffic 
statistics stored within that child node's parent node within the tree. 

Claim 29 (Original) The network elements of claim 28 9 wherein the control unit maintains the 
identifiers as a heap having a plurality of entries, wherein each entry stores a respective identifier 
for one of the packet flows. 

Claim 30 (Original) The network elements of claim 29, further comprising a user interface to 
receive a query from a client, wherein the control unit processes the heap in response to the query 
to select one or more of the identifiers, and the user interface outputs a portion of the traffic 
statistics associated with the selected identifiers. 

Claim 3 1 (Original) The network elements of claim 29, wherein the control unit clones the 
heap to produce a heap clone, and processes the heap clone to extracting the identifiers. 

Claim 32 (Original) The network elements of claim 29, wherein the control unit concurrently 
computes the flow statistics and maintains the identifiers concurrently with processing the heap 
and outputting the portion of the traffic statistics. 
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Claim 33 (Original) The network elements of claim 29, wherein the control unit associates the 
packets with the packet flows by determining for each packet at least one of a source network 
address, a destination network address, a protocol, a source port number, and a destination port 
number. 

Claim 34 (Original) The network elements of claim 28, wherein the control unit calculates the 
flow statistics and maintains the heap-ordered representation in real-time as packets are received 
from the interface card. 

Claim 35 (Original) The network elements of claim 28, wherein the control unit comprises an 
accounting module that calculates the traffic statistics. 

Claim 36 (Original) The network elements of claim 28, further comprising an accounting 
service card, wherein the control unit forwards the packets to the accounting service card to 
calculate the traffic statistics* 

Claim 37 (Original) The network elements of claim 28, wherein the control unit comprises: 
a routing engine to maintain routing information representing a topology of the network; and 
a forwarding engine to forward the network packets in accordance with the routing information. 

Claim 38 (Original) The network elements of claim 28, wherein the network device comprises 
one of a router, a switch, a gateway, and a hub. 

Claim 39 (Original) A network device comprising: 

an interface to receive packets flows from a network; 
a control unit coupled to the interface; and 

an accounting service card, wherein the control unit forwards the packets to the 
accounting service card to calculate the traffic statistics, wherein the accounting service card 
computes flow statistics for the packets, and maintains maintaining a heap that provides a heap- 
ordered representation of the packet flows. 
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Claim 40 (Original) The nctwork.device of claim 39, wherein the accounting service card 
comprises; 

a flow table to store the flow statistics: and 
a heap table to store the heap. 
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